Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects the execution of Lua interpreter binaries (LuaJit or lua) spawned from a specific process named 'HFY.exe', which is associated with the BeepRAT dropper. The rule also correlates this execution with suspicious raw disk read activity to identify potential in-memory payload loading or malicious interaction with system files.
Detects the execution of 'HFY.exe', which serves as the dropper for the BeepRAT malware. This dropper is typically distributed within a trojanized archive containing legitimate-looking DLLs, such as 'data.dll' (a disguised SQLite database), 'EPPlus.dll', and 'NPOI.dll'. The rule triggers when 'HFY.exe' is executed outside of standard program installation directories.
This rule detects instances where ImageMagick tools (magick.exe, convert.exe, mogrify.exe, identify.exe) launch Ghostscript (gswin64c.exe) from non-standard directory locations while passing specific flags (-dQUIET, -dSAFER, -dBATCH, -dNOPAUSE) that are frequently associated with exploitation payloads (e.g., ImageTragick).
This rule detects the extraction of a file from an archive (RAR) using 7-Zip utilities, followed by the execution of a file (exe, dll, js, etc.) from the Temp or Downloads directory within 120 seconds. This pattern is commonly observed during the execution phase of a malicious payload delivered via archives.
Detects the creation or modification of specific suspicious files (e.g., MediumInstStart.exe, SolidPDFCreator.dll, pcl2bmp.exe, ctxmui.dll) in common temporary or world-writable directories like ProgramData or Users/Public/Documents, which are often used by adversaries for staging tools or malware components.
This rule detects the loading of specific DLL files (SolidPDFCreator.dll, ctxmui.dll) by suspicious or masquerading process names (pcl2bmp.exe, Project Proposal.exe, Memorandum of Understanding.exe) from common user-writable or temporary directories, which is often indicative of side-loading or execution of malicious components.
Detects the creation or execution of suspicious LNK files masquerading as legitimate AnyDesk or N-able RMM configuration files (e.g., ApplianceConfig.lnk, ServerConfig.lnk) and unauthorized access to AnyDesk service or user configuration files (anydesk_svc.conf, anydesk_usr.conf). This behavior is associated with MexicanMafia's 'Operation Escaneo' for establishing persistent, low-visibility remote access.
Detects suspicious command-line execution of cmd.exe involving specific patterns like 'MiniJunk' or 'MiniBrowse', or command-line activity spawned from common file types (e.g., .exe, .doc, .pdf, .zip). This rule is designed to identify potential multi-stage payload execution or malicious dropper activity associated with the UNC1549 threat actor.
Detects the execution of PowerShell with encoded commands initiated by common office applications (e.g., WinWord, Excel) or scripting engines (e.g., wscript, mshta). The rule specifically targets command lines longer than 200 characters that are not digitally signed by Microsoft, often indicating obfuscated malicious payloads intended to evade detection.
Detects a browser launching cmd.exe or PowerShell immediately after a user visits or downloads content presented as an AI coding assistant installer. This rule specifically looks for process creation events where a browser (Chrome, Edge, Firefox) is the parent process, and the child process is a command shell (cmd.exe, powershell.exe, pwsh.exe), with the command line containing keywords related to 'claude', 'install', 'setup', 'copy paste', 'mshta', or 'download'.
Detects potential 'ClickFix' social engineering attacks where users are lured into manually executing malicious PowerShell or CMD commands via the Windows Run dialog following a browser crash, or using finger.exe as a LOLBIN to download payloads.
Detects a suspicious sequence of events attributed to APT37, where a HWP or HWPX decoy file is written to user-accessible staging directories (Downloads, Temp, Desktop, Public) followed by the execution of a .lnk file using cmd.exe or explorer.exe within 30 seconds on the same device.
Detects PowerShell execution with a command line indicative of a download cradle, initiated from the user's shell (explorer.exe). This behavior is characteristic of the "ClickFix" social engineering technique where a user is tricked into copying and running a malicious command from a webpage.
Detects the execution of 'HFY.exe' correlated with the presence of specific DLLs (e.g., data.dll, EPPlus.dll) characteristic of a trojanized Chinese telecom management utility. This behavior is indicative of the BeepRAT infection chain, where malicious binaries are executed from archives containing secondary dependencies.
Detects the execution of ClickOnce applications (via dfsvc.exe, rundll32.exe with dfshim.dll, or by opening .application/.appref-ms files) that are being launched from a remote web or file share source. This behavior is a common technique for proxying malicious code execution.
Detects a sequence of events where PowerShell is used to download files from 'nvidiadriver.net' or with filenames containing 'winPatch', followed by a suspicious file drop (specifically 'winPatch.zip' or 'update.vbs') in a temporary directory within a 30-minute window. This behavior is indicative of potential initial staging for a RAT or malicious script deployment.
This rule detects potential malicious activity where the 7-Zip utility spawns executable files or scripts. It monitors for child processes such as .exe, .js, .vbs, .ps1, or .bat files being executed from common user-writable directories (e.g., Downloads, Temp, Desktop). This pattern is often indicative of an adversary using a legitimate archive tool to extract and execute a malicious payload delivered via phishing or other initial access methods.
Detects indicators of active exploitation or malicious activity targeting the Flowise application. The rule triggers on the creation of a 'flowise_marker.txt' file, the spawning of node processes with suspicious command-line flags ('--require', 'node_options') potentially intended to bypass security controls, and the execution of unexpected shell or scripting processes (cmd, bash, python, etc.) by a Flowise process.
This rule identifies the execution or presence of a specific malicious installer executable (MD5 87603EA025623B19954E460ADD532048) that is known to be reused and renamed across multiple campaigns to masquerade as legitimate software installers.
Detects the execution of PowerShell with suspicious download-related commands (Invoke-WebRequest, DownloadFile, WebClient, IEX, DownloadString) when initiated through conhost.exe, specifically when the originating parent process is a common shell or utility associated with shortcut (.lnk) file execution or specific command patterns.
Detects the mounting of an ISO file, particularly those with diplomatic lure filenames, followed by the execution of an executable from a newly mounted optical or removable drive. This sequence of events is indicative of an attacker using a malicious ISO to deliver and execute malware.
Page 56 of 86